6804 matches found
CVE-2019-12869: Out-of-bounds Read
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-Of-Bounds Read, Information Disclosure, and remote code execution. The attacker needs to get access to an...
Phoenix Contact Automation Worx Software Suite Uninitialized Pointer Access Vulnerability
Automation Worx Software Suite is an automation software package from Phoenix Contact. An uninitialized pointer access vulnerability exists in the PC Worx, PC Worx Express, and Config+ components in Phoenix Contact Automation Worx Software Suite versions 1.86 and earlier. An attacker could exploi...
api-browser (>=0.0.1, <=0.0.3), koa2-swagger-ui (2.2.1) +2 more potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.13.3)
swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: unknown CVE Source advisory: OSV:GHSA-X9P2-FXQ6-2M5F...
PT-2019-2529
Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT PC Worx versions 1.86 and earlier PHOENIX CONTACT PC Worx Express versions 1.86 and earlier PHOENIX CONTACT Config+ versions 1.86 and earlier Description An issue was discovered that could lead to an Uninitialized Pointer and...
June 18, 2019âKB4503289 (OS Build 15063.1897)
None None...
WebP Express <= 0.14.10 - Multiple Issues
- Arbitrary File Viewing - CRSF - XSS including https://wpvulndb.com/vulnerabilities/9389 - Unauthorised Access...
WordPress WebP Express plugin <= 0.14.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found in WordPress WebP Express plugin versions = 0.14.0. Solution Update the WordPress WebP Express plugin to the latest available version at least 0.14.1...
Rate Limiting Bypass in express-brute
All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting...
7ghost (>=4.11.0, <=4.11.46), @agneta/platform (>=0.16.9, <=0.17.0) +68 more potentially affected by unknown CVE via express-brute (>=1.0.0, <=1.0.1)
express-brute NPM version =1.0.0, =4.11.0, =0.16.9, =0.0.2-publish-module-10a23dea78e8b2ead9b62883b97c62fe5e838b4d, =3.1.0-beta.9, =0.0.1, =1.0.0-0, =1.3.3, =1.0.0, =1.1.0, =3.41.6, =1.0.1, =1.1.42, =1.2.15 and more Source cves: unknown CVE Source advisory: OSV:GHSA-984P-XQ9M-4RJW...
GHSA-984P-XQ9M-4RJW Rate Limiting Bypass in express-brute
All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting...
PT-2019-20032
Name of the Vulnerable Software and Affected Versions express-brute versions all Description The issue allows an attacker to bypass rate limiting, potentially executing requests without limitation, due to concurrent requests leading to race conditions that cause incorrect request counting...
express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison
Versions of express-basic-auth prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the...
GHSA-C35V-QWQG-87JC express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison
Versions of express-basic-auth prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the...
@blitzbank/dashboard (>=0.0.1, <=0.0.2), @coinmesh/lnd-adapter (>=0.0.1, <=0.2.12) +11 more potentially affected by unknown CVE via express-basic-auth (>=1.0.0, <=1.1.6)
express-basic-auth NPM version =1.0.0, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.0.1, =1.0.0, =0.1.5, =1.0.0, =0.1.0, =2.0.0, =1.1.0, =1.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-C35V-QWQG-87JC...
PT-2019-20035
Name of the Vulnerable Software and Affected Versions express-basic-auth versions prior to 1.1.7 Description The issue concerns the use of native string comparison instead of a constant time string comparison in the express-basic-auth package. This can lead to timing attacks, which may increase t...
Duplicate Advisory: Privilege Escalation in express-cart
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hr89-w7p6-pjmq. This link is maintained to preserve external references. Original Description Versions of express-cart before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so...
PT-2019-19995
Name of the Vulnerable Software and Affected Versions express-cart versions prior to 1.1.6 Description The issue allows normal users to escalate their privileges, enabling them to add new administrator users. Recommendations Update to version 1.1.6 or later...
Cross-site Scripting (XSS)
express-validator is vulnerable to cross-site scripting XSS. The vulnerability exists as it was possible to bypass the sanitize function as the toString function does not sanitize arrays...
Admin Express 1.2.5.485 - Folder Path Local SEH Alphanumeric Encoded Buffer Overflow
Admin Express 1.2.5.485 - Folder Path Local SEH Alphanumeric Encoded Buffer Overflow Title: Admin Express v1.2.5.485 'Folder Path' Local SEH Alphanumeric Encoded Buffer Overflow Date: May 6th, 2019 Author: Connor McGarr https://connormcgarr.github.io Vendor Homepage:...
Admin Express 1.2.5.485 Buffer Overflow Exploit
Exploit for windows platform in category local exploits Title: Admin Express v1.2.5.485 Folder Path Local SEH Alphanumeric Encoded Buffer Overflow Date: May 6th, 2019 Author: Connor McGarr https://connormcgarr.github.io Vendor Homepage: https://admin-express.en.softonic.com/ Software Link:...